CVE-2022-23117
Agent-to-controller security bypass in Jenkins Conjur Secrets Plugin allows retrieving all credentials
Résumé
Agent-to-controller security bypass in Jenkins Conjur Secrets Plugin allows retrieving all credentials
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to retrieve all username/password credentials stored on the Jenkins controller.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Maven
org.conjur.jenkins:conjur-credentials
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10"}]}]
Références
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web jenkins.io
- web openwall.com